A pair of serious WordPress vulnerabilities have been combined into a new exploit chain dubbed “WP2Shell,” which allows attackers to skip login entirely, install rogue administrator accounts, and set up web shells via plugins. Researchers discovered the flaws in July 2026 and released full details in mid-October, raising alarms for site owners who haven’t patched.
How WP2Shell Works
The attack leverages two vulnerabilities in WordPress Core: one route-handling bug (CVE-2026-63030) in the REST API Batch controller located at /wp-json/batch/v1, and an SQL injection weakness (CVE-2026-60137) in the public “author_exclude” parameter of the posts endpoint. The first flaw allows nested unauthenticated requests to reach code paths that should require login; the second enables manipulation of database queries. When chained, they enable server-side code execution.
With this combo, attackers can stealthily create administrator accounts, stage ZIP archives in uploads, extract PHP files, and deploy a plugin directory under wp-content/plugins to act as a backdoor or web shell. The threat is not theoretical—crafted exploits can deploy full control without ever needing usual WordPress login credentials.
Which Versions Are at Risk, and How to Mitigate
Sites running WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to the full exploit chain. Versions 6.8.0 through 6.8.5 have only the SQL injection issue but are still exposed to partial risk. Fixed releases include 6.8.6, 6.9.5, and 7.0.2. Upgrading to one of these patched versions (or later supported builds) is the essential first step.
Other steps to reduce exposure include restricting unauthenticated access to sensitive REST API endpoints (where possible), auditing for unexpected administrator accounts, and scanning plugin, uploads, and cache directories for suspicious PHP files or archives.
Detecting and Responding to a Compromise
Indicator-of‐Compromise (IoC) signs include files named temp-write-test-* under wp-content, ZIPs named like wp2shell_*.zip in upload subfolders (often uploads/2026/10), plugin folders with names like wp2shell_, and PHP files likewise matching wp2shell_. Unexpected administrator user accounts or unfamiliar PHP file additions in plugins or cache should also raise red flags. Even if WordPress has been updated, older compromises aren’t automatically cleared by patching alone. Discovery of such artifacts should trigger disabling suspect plugins, resetting credentials, preserving evidence, and investigating for persistence.
This threat was thoroughly analyzed by cybersecurity firm Seqrite, which mapped the full chain and raised awareness about how the two flaws interact to form WP2Shell. To date, there’s no public evidence of widespread compromises—but exposed sites would be vulnerable from day one of disclosure without patching.
Why this matters: Unlike many WordPress vulnerabilities that require compromised credentials or user interaction, WP2Shell lets attackers bypass login entirely. That heightens urgency for administrators of public WordPress installations to update immediately. The risk extends beyond typical web defacement—this allows deep server-side control.
